Security
Updated: July 14, 2026
We work with sensitive data — Telegram authorization sessions. That is why security is part of our architecture, not a marketing section. Here is what we actually do.
Encryption
- All traffic between you and GramGPT is transmitted over HTTPS (TLS).
- Telegram sessions and 2FA passwords are encrypted at rest (AES-128-CBC + HMAC-SHA256). The encryption key is stored separately from the database, so a database dump or a leaked backup does not expose sessions.
- Sessions are bound to your account and are not accessible to other users of the service.
Payments
We do not store or process card data. All payments go through third-party payment gateways (WayForPay, CryptoBot, Antilopay) — card details never reach our servers.
Storage and access
- Servers are hosted in data centers within the EU (Germany).
- Access to production infrastructure is limited to a strictly small circle (the project founders).
- Database backups are created automatically and regularly.
Authentication
- Sign-in via JWT tokens, Google OAuth is supported.
- User passwords are stored only as hashes (PBKDF2) — the original password cannot be recovered from the database.
Monitoring
Infrastructure and errors are monitored around the clock (Sentry, Prometheus, Grafana). The team sees failures and anomalies in real time.
Recommendations for users
Any cloud service that works with Telegram sessions becomes a trusted party by definition. We recommend:
- using dedicated work accounts for automation instead of your personal Telegram;
- enabling 2FA on your accounts and keeping passwords in a password manager;
- removing accounts you no longer use from the service.
Report a vulnerability
Found a vulnerability? Contact us directly — we handle such reports with priority and do not pursue researchers acting in good faith.